Major change that brought the chart in line with others. Mainly by more heavily relyng on subcharts and *.tpl files for code modularity and reusability (and consistency)
All checks were successful
Deploy the Helm Chart / build (push) Successful in 15s
All checks were successful
Deploy the Helm Chart / build (push) Successful in 15s
This commit is contained in:
Alan Bridgeman
parent
84a322eb28
commit
563a76b84e
34 changed files with 621 additions and 1103 deletions
|
|
@ -5,7 +5,7 @@ metadata:
|
|||
labels:
|
||||
app: {{ .Release.Name }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
replicas: {{ .Values.app.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Release.Name }}
|
||||
|
|
@ -16,15 +16,15 @@ spec:
|
|||
spec:
|
||||
containers:
|
||||
- name: {{ .Release.Name }}
|
||||
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
image: {{ .Values.app.image.repository }}:{{ .Values.app.image.tag }}
|
||||
imagePullPolicy: {{ .Values.app.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.container.port }}
|
||||
- containerPort: {{ .Values.app.container.port }}
|
||||
env:
|
||||
- name: NODE_ENV
|
||||
value: {{ .Values.container.env }}
|
||||
value: {{ .Values.app.container.env }}
|
||||
- name: PORT
|
||||
value: "{{ .Values.container.port }}"
|
||||
value: "{{ .Values.app.container.port }}"
|
||||
- name: DOMAIN
|
||||
value: "bridgemanaccessible.ca"
|
||||
- name: ACCOUNTS_DEV_PORT
|
||||
|
|
@ -57,51 +57,9 @@ spec:
|
|||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-oauth-credentials
|
||||
key: dev-port
|
||||
# Database credentials
|
||||
- name: DB_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-db-credentials
|
||||
key: db-host
|
||||
- name: DB_NAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-db-credentials
|
||||
key: db-name
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-db-password
|
||||
key: password
|
||||
- name: DB_PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-db-credentials
|
||||
key: db-port
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-db-credentials
|
||||
key: db-user
|
||||
# NoSQL Credentials
|
||||
{{- if eq .Values.nosql.type "mongodb" }}
|
||||
- name: STORAGE_ACCOUNT_CONNECTION_STRING
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-mongo-credentials
|
||||
key: connection-string
|
||||
{{- else if eq .Values.nosql.type "azure" }}
|
||||
- name: STORAGE_ACCOUNT_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-azure-tables-credentials
|
||||
key: key
|
||||
- name: STORAGE_ACCOUNT_NAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-azure-tables-config
|
||||
key: name
|
||||
{{- end }}
|
||||
{{- include "db.envVars" . | nindent 8 }}
|
||||
{{- include "cache.envVars" . | nindent 8 }}
|
||||
{{- include "nosql.envVars" . | nindent 8 }}
|
||||
# NoSQL Grouping Names
|
||||
- name: ACCESS_PROPERTIES_STORAGE_TABLE_NAME
|
||||
valueFrom:
|
||||
|
|
@ -169,22 +127,6 @@ spec:
|
|||
key: vault-port
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
# Caching Server Variables
|
||||
- name: CACHE_HOSTNAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-cache-configmap
|
||||
key: hostname
|
||||
- name: CACHE_PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-cache-configmap
|
||||
key: port
|
||||
- name: CACHE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-cache-credentials
|
||||
key: password
|
||||
# Email (Azure Communication Services API credentials, etc...)
|
||||
{{- if and (.Values.comms.email.enabled) (eq .Values.comms.email.type "acs") }}
|
||||
- name: EMAIL_CONNECTION_STRING
|
||||
|
|
@ -195,91 +137,23 @@ spec:
|
|||
{{- end }}
|
||||
# Third-Party Integrations
|
||||
{{- if .Values.thirdParty.stripe.enabled }}
|
||||
- name: STRIPE_PUBLIC_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-stripe-secret
|
||||
key: public-key
|
||||
- name: STRIPE_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-stripe-secret
|
||||
key: secret-key
|
||||
- name: STRIPE_TEST_PUBLIC_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-stripe-secret
|
||||
key: test-public-key
|
||||
- name: STRIPE_TEST_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-stripe-secret
|
||||
key: test-secret-key
|
||||
{{- /* This injects the YAML defined in the `_thirdParty.tpl` file */ -}}
|
||||
{{ include "stripe.envVars" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.thirdParty.moneris.enabled }}
|
||||
- name: MONERIS_MERCHANT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: merchant-id
|
||||
- name: MONERIS_STORE_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: store-id
|
||||
- name: MONERIS_HT_PROFILE_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: ht-profile-id
|
||||
- name: MONERIS_APP_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: app-id
|
||||
- name: MONERIS_APP_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: app-secret
|
||||
- name: MONERIS_TEST_MERCHANT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: test-merchant-id
|
||||
- name: MONERIS_TEST_STORE_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: test-store-id
|
||||
- name: MONERIS_TEST_HT_PROFILE_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: test-ht-profile-id
|
||||
- name: MONERIS_TEST_APP_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: test-app-id
|
||||
- name: MONERIS_TEST_APP_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-moneris-secret
|
||||
key: test-app-secret
|
||||
{{- /* This injects the YAML defined in the `_thirdParty.tpl` file */ -}}
|
||||
{{ include "moneris.envVars" . | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: INITIAL_USER_ID
|
||||
value: {{ .Values.initialUserID | quote }}
|
||||
# Logging Sidecar related environment variables
|
||||
{{- if .Values.loggingSidecar.enabled }}
|
||||
- name: LOGGING_SIDE_CAR_PORT
|
||||
value: {{ .Values.loggingSidecar.port | quote }}
|
||||
{{- include "logging.envVars" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.app.restoreFromBackup "" }}
|
||||
# Due to subtleties related to how the entrypoint scripts detects how/when to proceed
|
||||
# This environment variable indicates if the entrypoint should wait for a restore to complete
|
||||
{{- if ne .Values.container.restoreFromBackup "" }}
|
||||
- name: RESTORE_FROM_BACKUP
|
||||
value: {{ .Values.container.restoreFromBackup | quote }}
|
||||
value: {{ .Values.app.restoreFromBackup | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vault.create.enabled }}
|
||||
volumeMounts:
|
||||
|
|
@ -292,120 +166,23 @@ spec:
|
|||
mountPath: /role_vars
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: {{ .Values.app.resources.requests.cpu }}
|
||||
memory: {{ .Values.app.resources.requests.memory }}
|
||||
ephemeral-storage: {{ .Values.app.resources.requests.ephemeralStorage }}
|
||||
limits:
|
||||
cpu: {{ .Values.app.resources.limits.cpu }}
|
||||
memory: {{ .Values.app.resources.limits.memory }}
|
||||
ephemeral-storage: {{ .Values.app.resources.limits.ephemeralStorage }}
|
||||
# Logging sidecar for sending logs to a log aggregator
|
||||
{{- if .Values.loggingSidecar.enabled }}
|
||||
- name: {{ .Values.loggingSidecar.name }}
|
||||
image: {{ .Values.loggingSidecar.image.repository }}:{{ .Values.loggingSidecar.image.tag }}
|
||||
imagePullPolicy: {{ .Values.loggingSidecar.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.loggingSidecar.port }}
|
||||
env:
|
||||
- name: PORT
|
||||
value: {{ .Values.loggingSidecar.port | quote }}
|
||||
# Log aggregator (OpenObserve) auth variables
|
||||
- name: LOGGER_AUTH_USERNAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-logging-sidecar-credentials
|
||||
key: username
|
||||
- name: LOGGER_AUTH_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-logging-sidecar-password
|
||||
key: password
|
||||
{{ include "logging.sidecar" . | nindent 6 }}
|
||||
{{- end }}
|
||||
# Backup sidecar for backing up service data
|
||||
{{- if .Values.backupSidecar.enabled }}
|
||||
- name: {{ .Values.backupSidecar.name }}
|
||||
image: {{ .Values.backupSidecar.image.repository }}:{{ .Values.backupSidecar.image.tag }}
|
||||
imagePullPolicy: {{ .Values.backupSidecar.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.backupSidecar.port }}
|
||||
env:
|
||||
# Release name (used to identify the service/release the backups came from in remote storage)
|
||||
- name: RELEASE_NAME
|
||||
value: {{ .Release.Name }}
|
||||
# Database related environment variables
|
||||
- name: DB_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-db-credentials
|
||||
key: db-host
|
||||
- name: DB_NAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-db-credentials
|
||||
key: db-name
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-db-password
|
||||
key: password
|
||||
- name: DB_PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-db-credentials
|
||||
key: db-port
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-db-credentials
|
||||
key: db-user
|
||||
{{- if .Values.vault.create.snapshotServer.enabled }}
|
||||
- name: VAULT_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-vault-secret
|
||||
key: vault-name
|
||||
- name: VAULT_SNAPSHOT_SERVER_PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-vault-snapshot-config
|
||||
key: port
|
||||
{{- end }}
|
||||
# NoSQL storage related environment variables
|
||||
# Note, we only worry about self-hosted options as cloud-based should have their own backups etc...
|
||||
{{- if eq .Values.nosql.type "mongodb" }}
|
||||
- name: STORAGE_ACCOUNT_CONNECTION_STRING
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-mongo-credentials
|
||||
key: connection-string
|
||||
{{- end }}
|
||||
# Redis related environment variables
|
||||
# Redis is used for BullMQ, which is how we schedule backups
|
||||
# We use this instead of, for instance cron jobs, as it lets us deal with failures
|
||||
- name: REDIS_HOSTNAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-cache-configmap
|
||||
key: hostname
|
||||
- name: REDIS_PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ .Release.Name }}-cache-configmap
|
||||
key: port
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-cache-credentials
|
||||
key: password
|
||||
{{- if .Values.vault.create.snapshotServer.enabled }}
|
||||
volumeMounts:
|
||||
# Mount for a shared volume for Vault credentials
|
||||
# This is separate from the app's `role vars` volume because it includes other credentials
|
||||
# In particular, the unseal keys which we require when/if we restore from the backup
|
||||
# This volume is also read-only where the `role-vars` is read-write (see description below for why)
|
||||
- name: creds
|
||||
mountPath: /vault-creds
|
||||
readOnly: true
|
||||
# Mount for a shared volume for the Vault's role variables for the app
|
||||
# This is required by the backup sidecar because if a restart of the app occurs AFTER a vault has been reset (ex. vault using a different container instance),
|
||||
# despite the vault data being restored the app would receive incorrect credentials (because this is ONLY written during setup of the vault)
|
||||
# The backup sidecar mitigates this by doing it's own write (to overwrite) once it's done a restore
|
||||
- name: role-vars
|
||||
mountPath: /role_vars
|
||||
{{- end }}
|
||||
{{- /* This injects the YAML defined in the `_sidecar.tpl` file */ -}}
|
||||
{{ include "backupSidecar" . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vault.create.enabled }}
|
||||
volumes:
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue